Wopisanje
Vixns Commerce Profile for Universal Commerce Protocol writes an honest business profile JSON to a static file at /.well-known/ucp, can expose UCP catalog REST (search / lookup / product), and can publish keys[] (JWK Set) with rotation for Web Bot Auth type=jwks_uri interop.
This is a third-party WooCommerce integration by Vixns. It is not an official Universal Commerce Protocol product.
- Spec target: 2026-08-25
- Never advertises checkout, cart, or payment handlers
- Private keys stored under
uploads/vixns-commerce-profile-ucp/private/(Apache/IIS deny files are written automatically; block the path on nginx) - Optional product feed (JSONL), not linked from the profile
- Catalog REST is intentionally open to agents that send a valid
UCP-Agentheader (same visibility as a public product catalog)
Instalacija
- Install and activate WooCommerce.
- Upload the
vixns-commerce-profile-ucpfolder to/wp-content/plugins/(or install the ZIP via Plugins Add New). - Activate Vixns Commerce Profile for Universal Commerce Protocol.
- Configure your web server to serve
/.well-known/ucpas static JSON withCache-Control: public, max-age≥60and no redirects. - Open WooCommerce Settings Vixns UCP, set the canonical HTTPS host if needed, then Generate now.
Example nginx location (adjust root):
location = /.well-known/ucp {
default_type application/json;
add_header Cache-Control "public, max-age=300" always;
add_header Access-Control-Allow-Origin "*" always;
add_header Access-Control-Allow-Methods "GET, HEAD" always;
try_files /.well-known/ucp =404;
}
# Deny private key material (nginx ignores .htaccess):
location ^~ /wp-content/uploads/vixns-commerce-profile-ucp/private/ {
deny all;
return 403;
}
HSP
-
How do I serve /.well-known/ucp?
-
See the nginx example under Installation. Do not apply wwwapex redirects to this URI — UCP platforms do not follow 3xx on the profile URL.
-
Web Bot Auth
-
Use:
Signature-Agent: sig1="https://yoursite/.well-known/ucp";type=jwks_uriOmitting
typedefaults todirectory, which does not read this static profile. -
Catalog REST
-
Base:
/wp-json/ucp/v1— POST/catalog/search,/catalog/lookup,/catalog/product.
Requires header:UCP-Agent: profile="https://yoursite/.well-known/ucp".
There is no WordPress cookie auth on these routes (agent discovery). Disable Catalog REST in settings if you do not want them. -
Where are private keys stored?
-
Default:
wp-content/uploads/vixns-commerce-profile-ucp/private/. Prefer a path outside the document root via thevixns_ucp_private_key_dirfilter. On nginx, always deny the default directory explicitly. -
Is this an official Universal Commerce Protocol plugin?
-
No. It is developed by Vixns as a third-party WooCommerce integration.
Pohódnoćenja
Za tutón tykač pohódnoćenja njejsu.
Sobuskutkowarjo a wuwiwarjo
„Vixns Commerce Profile for Universal Commerce Protocol“ je softwara wotewrjeneho žórła. Slědowacy ludźo su k tutomu tykačej přinošowali.
Sobuskutkowarjo
Přełožće „Vixns Commerce Profile for Universal Commerce Protocol“ do swojeje rěče.
Na wuwiću zajimowany?
Přehladajće kod, hladajće do SVN-repozitorija abo abonujće wuwiwanski protokol přez RSS.
Protokol změnow
0.4.0
- Renamed for WordPress.org trademark clarity (slug vixns-commerce-profile-ucp).
- Private keys and feed default under uploads/{slug}/; tightened write allowlist to .well-known + uploads plugin dir.
0.3.0
- Signing keys[] (EdDSA/ES256), rotate/revoke, WBA jwks_uri documentation.
- Path allowlist for profile/feed writes; HTTPS-only canonical host / probe.
- Test-only failure filters gated behind VIXNS_UCP_TESTING.
0.2.0
- Catalog REST: search, lookup, product; profile advertises services + catalog capabilities.
0.1.0
- Initial release: profile generation, dual scheduler, WP-CLI, admin status/probe, optional JSONL feed.